Chrome 157.0.8103.78 Patches 83 Flaws Including Critical CVE-2026-126885 and CVE-2026-126895 — Enterprise Update and Detection Guide

---
title: Chrome Browser Process Spawning Script Interpreter or Shell
id: 8b1e4f92-3c7a-4d55-9e21-6f8a2b4c9d01
status: experimental
description: Detects chrome.exe spawning command shells, script interpreters, or LOLBins as child processes. A compromised or escaped Chrome renderer frequently hands off execution to cmd, powershell, wscript, or mshta for payload staging.
references:
  - http://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html
  - https://attack.mitre.org/techniques/T1203/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/11/17
tags:
  - attack.execution
  - attack.t1203
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\chrome.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\wmic.exe'
      - '\bitsadmin.exe'
      - '\certutil.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare enterprise browser extensions or SSO tooling invoking helper processes
  - Legitimate software updaters launched via browser
title_note: Tune against known-good extension behavior before broad deployment.
level: high
---
title: Outdated Chrome Version Executing on Endpoint
id: 2f6c9d18-7b4e-4a93-8c15-3d9e5f7a0b12
status: experimental
description: Detects execution of chrome.exe from a non-standard or user-writable path, which can indicate sideloaded or trojanized browser binaries used in post-exploitation. Combine with fleet version inventory for CVE-2026-126885/CVE-2026-126895 exposure tracking.
references:
  - http://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_01744469280.html
  - https://attack.mitre.org/techniques/T1218/
author: Security Arsenal
date: 2026/11/17
tags:
  - attack.defense_evasion
  - attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\chrome.exe'
  filter_standard_paths:
    Image|startswith:
      - 'C:\Program Files\Google\Chrome\Application\'
      - 'C:\Program Files (x86)\Google\Chrome\Application\'
  condition: selection and not filter_standard_paths
falsepositives:
  - Portable Chrome installations (rare in managed environments)
  - Developer or test builds in AppData
level: medium

// Hunt 1: Fleet-wide Chrome version inventory — flag endpoints below 157.0.8103.78
DeviceFileEvents
| where TimeGenerated > ago(7d)
| where FileName =~ "chrome.exe"
| where FolderPath has "Google\\Chrome\\Application"
| summarize arg_max(TimeGenerated, *) by DeviceName, FolderPath
| extend VersionString = extract(@"Application\\(\d+\.\d+\.\d+\.\d+)", 1, FolderPath)
| extend VersionParts = split(VersionString, ".")
| extend Major = toint(VersionParts[0]), Minor = toint(VersionParts[1]), Build = toint(VersionParts[2]), Patch = toint(VersionParts[3])
| extend IsVulnerable = (Major < 157) or (Major == 157 and Build < 8103) or (Major == 157 and Build == 8103 and Patch < 78)
| where IsVulnerable == true
| project DeviceName, VersionString, TimeGenerated
| sort by DeviceName asc

// Hunt 2: Chrome spawning script interpreters or shells (post-exploitation behavior)
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName =~ "chrome.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "wmic.exe", "bitsadmin.exe", "certutil.exe")
| project TimeGenerated, DeviceName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName, InitiatingProcessId
| sort by TimeGenerated desc

// Hunt 3: Chrome child processes establishing outbound network connections (renderer escape beaconing)
DeviceNetworkEvents
| where TimeGenerated > ago(3d)
| where InitiatingProcessFileName in~ ("cmd.exe", "powershell.exe", "rundll32.exe", "regsvr32.exe")
| join kind=inner (
    DeviceProcessEvents
    | where TimeGenerated > ago(3d)
    | where InitiatingProcessFileName =~ "chrome.exe"
    | project DeviceName, ProcessId, ProcessCreationTime=TimeGenerated
) on DeviceName
| project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteIP, RemoteUrl, RemotePort
| where RemotePort !in (80, 443) or RemoteUrl !has_any ("google.com", "gstatic.com", "googleapis.com")

-- Hunt: Chrome version inventory and suspicious process ancestry
-- Validates CVE-2026-126885 / CVE-2026-126895 exposure across the fleet

-- Part 1: Enumerate Chrome install directories and versions
SELECT FullPath AS ChromeBinary,
       basename(path=dirname(path=FullPath)) AS InstallDir,
       Mtime AS BinaryModified
FROM glob(globs='C:/Program Files*/Google/Chrome/Application/*/chrome.exe')

-- Part 2: Running Chrome processes with parent process detail
SELECT Pid,
       Ppid,
       Name,
       Exe,
       CommandLine,
       Username,
       CreateTime
FROM pslist()
WHERE Name =~ '(?i)chrome\.exe'
   OR Exe =~ '(?i)chrome\.exe'

-- Part 3: Shell or script interpreter processes parented to Chrome (post-exploitation indicator)
SELECT child.Pid AS ChildPid,
       child.Name AS ChildName,
       child.CommandLine AS ChildCommandLine,
       child.Username AS RunAs,
       parent.Name AS ParentName,
       parent.Exe AS ParentExe
FROM pslist() AS child
JOIN pslist() AS parent ON child.Ppid = parent.Pid
WHERE parent.Name =~ '(?i)chrome\.exe'
  AND child.Name =~ '(?i)(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32|wmic|bitsadmin|certutil)\.exe'

# Chrome CVE-2026-126885 / CVE-2026-126895 exposure check and remediation
# Flags any Chrome install below 157.0.8103.78

$FixedVersion = [version]"157.0.8103.78"
$chromePaths = @(
    "${env:ProgramFiles}\Google\Chrome\Application\chrome.exe",
    "${env:ProgramFiles(x86)}\Google\Chrome\Application\chrome.exe",
    "${env:LOCALAPPDATA}\Google\Chrome\Application\chrome.exe"
)

$found = $false
foreach ($path in $chromePaths) {
    if (Test-Path $path) {
        $found = $true
        $installed = [version](Get-Item $path).VersionInfo.ProductVersion
        if ($installed -lt $FixedVersion) {
            Write-Warning "VULNERABLE: Chrome $installed at $path (below $FixedVersion)"
            # Force update channel re-check via Google Update
            $updateExe = "${env:ProgramFiles(x86)}\Google\Update\GoogleUpdate.exe"
            if (Test-Path $updateExe) {
                Start-Process $updateExe -ArgumentList "/ua /installsource scheduler" -WindowStyle Hidden
                Write-Host "Triggered Google Update re-check."
            }
        } else {
            Write-Host "OK: Chrome $installed at $path is patched."
        }
    }
}

# Enumerate versioned Application subdirectories (multi-install edge cases)
Get-ChildItem "${env:ProgramFiles}\Google\Chrome\Application" -Directory -ErrorAction SilentlyContinue |
    Where-Object { $_.Name -match '^\d+\.\d+\.\d+\.\d+$' } |
    ForEach-Object {
        $v = [version]$_.Name
        if ($v -lt $FixedVersion) {
            Write-Warning "STALE BUILD DIRECTORY: $($_.FullName) — consider cleanup after update."
        }
    }

if (-not $found) { Write-Host "Chrome not found on this host." }

# Exit code for RMM alerting: 1 = vulnerable found

#!/bin/bash
# Chrome version verification for CVE-2026-126885 / CVE-2026-126895
FIXED_MAJOR=157
FIXED_BUILD=8103
FIXED_PATCH=78

INSTALLED=$(google-chrome --version 2>/dev/null | grep -oP '\d+\.\d+\.\d+\.\d+')
if [ -z "$INSTALLED" ]; then
  echo "Chrome not installed."; exit 0
fi

IFS='.' read -r MAJ MIN BLD PAT <<< "$INSTALLED"
if [ "$MAJ" -lt "$FIXED_MAJOR" ] || { [ "$MAJ" -eq "$FIXED_MAJOR" ] && [ "$BLD" -lt "$FIXED_BUILD" ]; } || { [ "$MAJ" -eq "$FIXED_MAJOR" ] && [ "$BLD" -eq "$FIXED_BUILD" ] && [ "$PAT" -lt "$FIXED_PATCH" ]; }; then
  echo "VULNERABLE: Chrome $INSTALLED < ${FIXED_MAJOR}.x.${FIXED_BUILD}.${FIXED_PATCH}"
  # Debian/Ubuntu:
  apt-get update && apt-get install -y --only-upgrade google-chrome-stable
  # RHEL/Fedora: dnf upgrade -y google-chrome-stable
  exit 1
else
  echo "OK: Chrome $INSTALLED is patched."
  exit 0
fi